From c26d7e2d4064a0bc0ab548137b040bf4e4b166f6 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 18:47:10 -0300
Subject: [PATCH 01/15] chore(deps): pin yauzl to ^3.2.1 (GHSA-gmq8-994r-jv83)

Fixes off-by-one error in yauzl. The only consumer is
mongodb-memory-server-core.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 65d361716575b..dbba0783ae8b1 100644
--- a/package.json
+++ b/package.json
@@ -44,6 +44,7 @@
 		"mongodb": "6.10.0",
 		"underscore": "1.13.8",
 		"webpack": "~5.104.0",
+		"yauzl": "^3.2.1",
 		"yoga-layout@npm:^3.2.1": "patch:yoga-layout@npm%3A3.2.1#~/.yarn/patches/yoga-layout-npm-3.2.1-51ec934670.patch",
 		"@react-pdf/layout@npm:^4.4.2": "patch:@react-pdf/layout@npm%3A4.4.2#~/.yarn/patches/@react-pdf-layout-npm-4.4.2-6c2e3312fa.patch",
 		"react-aria@npm:~3.37.0": "patch:react-aria@npm%3A3.37.0#~/.yarn/patches/react-aria-npm-3.37.0-83959bd2fa.patch",
diff --git a/yarn.lock b/yarn.lock
index e4fddd487ba62..dca395c261c5e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -38433,13 +38433,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yauzl@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "yauzl@npm:3.2.0"
+"yauzl@npm:^3.2.1":
+  version: 3.3.0
+  resolution: "yauzl@npm:3.3.0"
   dependencies:
     buffer-crc32: "npm:~0.2.3"
     pend: "npm:~1.2.0"
-  checksum: 10/a3cd2bfcf7590673bb35750f2a4e5107e3cc939d32d98a072c0673fe42329e390f471b4a53dbbd72512229099b18aa3b79e6ddb87a73b3a17446080c903a2c4b
+  checksum: 10/ac8ae5276a3fb89b80464fc828aadcb5f888af7306a7920e699b9de05aead0490ac6698bc71952ea867c3f2a2c73ed8df91f18f5b6a67ce3231065327817c08f
   languageName: node
   linkType: hard
 

From 953950d9a06a9a7acdb811969d7a3fc0d630dd38 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 18:50:08 -0300
Subject: [PATCH 02/15] chore(deps): pin serialize-javascript to ^7.0.5
 (GHSA-qj8w-gfj5-8c6v)

Fixes CPU Exhaustion DoS via crafted array-like objects. Affects the
dev-only consumers mocha and terser-webpack-plugin. Verified webpack
build still succeeds.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json |  1 +
 yarn.lock    | 19 ++++---------------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/package.json b/package.json
index dbba0783ae8b1..0f286a9f208ff 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
 		"lodash": "4.17.21",
 		"minimist": "1.2.6",
 		"mongodb": "6.10.0",
+		"serialize-javascript": "^7.0.5",
 		"underscore": "1.13.8",
 		"webpack": "~5.104.0",
 		"yauzl": "^3.2.1",
diff --git a/yarn.lock b/yarn.lock
index dca395c261c5e..9b7660d910338 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -33959,21 +33959,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"serialize-javascript@npm:6.0.0":
-  version: 6.0.0
-  resolution: "serialize-javascript@npm:6.0.0"
-  dependencies:
-    randombytes: "npm:^2.1.0"
-  checksum: 10/ed3dabfbb565c48c9eb1ca8fe58f0d256902ab70a8a605be634ddd68388d5f728bb0bd1268e94fab628748ba8ad8392f01b05f3cbe1e4878b5c58c669fd3d1b4
-  languageName: node
-  linkType: hard
-
-"serialize-javascript@npm:^6.0.2":
-  version: 6.0.2
-  resolution: "serialize-javascript@npm:6.0.2"
-  dependencies:
-    randombytes: "npm:^2.1.0"
-  checksum: 10/445a420a6fa2eaee4b70cbd884d538e259ab278200a2ededd73253ada17d5d48e91fb1f4cd224a236ab62ea7ba0a70c6af29fc93b4f3d3078bf7da1c031fde58
+"serialize-javascript@npm:^7.0.5":
+  version: 7.0.5
+  resolution: "serialize-javascript@npm:7.0.5"
+  checksum: 10/6237c76ef6df3d1ad61dd4a393b71ca758c7654f4d1cf77529e513134c0f0660302e03b7ec88a8f3a3daa79e1f93d6de8218ecbc45e073d7cc6b66284a1d3e83
   languageName: node
   linkType: hard
 

From 46813c0647b78a7d92c8b04431acc30a129d36b4 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 18:51:03 -0300
Subject: [PATCH 03/15] chore(deps): pin path-to-regexp ^8.1.0 range to ^8.4.0
 (GHSA-27v5-c462-wpq7)

Fixes ReDoS via multiple wildcards. Affects 8.x consumers @slack/bolt
and nise (sinon). Other 6.x/0.x resolutions (livechat, meteor, express)
are untouched by the range-scoped resolution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 0f286a9f208ff..f58f5eea78503 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
 		"lodash": "4.17.21",
 		"minimist": "1.2.6",
 		"mongodb": "6.10.0",
+		"path-to-regexp@npm:^8.1.0": "^8.4.0",
 		"serialize-javascript": "^7.0.5",
 		"underscore": "1.13.8",
 		"webpack": "~5.104.0",
diff --git a/yarn.lock b/yarn.lock
index 9b7660d910338..0e7122291e61f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -30323,10 +30323,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-to-regexp@npm:^8.1.0":
-  version: 8.2.0
-  resolution: "path-to-regexp@npm:8.2.0"
-  checksum: 10/23378276a172b8ba5f5fb824475d1818ca5ccee7bbdb4674701616470f23a14e536c1db11da9c9e6d82b82c556a817bbf4eee6e41b9ed20090ef9427cbb38e13
+"path-to-regexp@npm:^8.4.0":
+  version: 8.4.2
+  resolution: "path-to-regexp@npm:8.4.2"
+  checksum: 10/70fd2cbce0b962cbcf4d312af07818bfce2bae11c09cf3bd86be99c0e30168238a1a7b02b18b452e73f075897df04597d30d63e56da7be41eecfc37998693389
   languageName: node
   linkType: hard
 

From c58ac8c4caa549f49947d200ec16a75eff4326bf Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 18:52:18 -0300
Subject: [PATCH 04/15] chore(deps): pin markdown-it to ^14.1.1
 (GHSA-38c4-r59v-3vqw)

Fixes ReDoS. The only consumer is typedoc (dev-only).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index f58f5eea78503..5e9c3346f221b 100644
--- a/package.json
+++ b/package.json
@@ -40,6 +40,7 @@
 		"cross-spawn": "7.0.6",
 		"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
 		"lodash": "4.17.21",
+		"markdown-it": "^14.1.1",
 		"minimist": "1.2.6",
 		"mongodb": "6.10.0",
 		"path-to-regexp@npm:^8.1.0": "^8.4.0",
diff --git a/yarn.lock b/yarn.lock
index 0e7122291e61f..c2dddbed6997c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -27849,9 +27849,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"markdown-it@npm:^14.1.0":
-  version: 14.1.0
-  resolution: "markdown-it@npm:14.1.0"
+"markdown-it@npm:^14.1.1":
+  version: 14.1.1
+  resolution: "markdown-it@npm:14.1.1"
   dependencies:
     argparse: "npm:^2.0.1"
     entities: "npm:^4.4.0"
@@ -27861,7 +27861,7 @@ __metadata:
     uc.micro: "npm:^2.1.0"
   bin:
     markdown-it: bin/markdown-it.mjs
-  checksum: 10/f34f921be178ed0607ba9e3e27c733642be445e9bb6b1dba88da7aafe8ba1bc5d2f1c3aa8f3fc33b49a902da4e4c08c2feadfafb290b8c7dda766208bb6483a9
+  checksum: 10/088822c8aa9346ba4af6a205f6ee0f4baae55e3314f040dc5c28c897d57d0f979840c71872b3582a6a6e572d8c851c54e323c82f4559011dfa2e96224fc20fc2
   languageName: node
   linkType: hard
 

From b3ff071db6401a2e876a3dde3f25042e074d2dde Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 18:53:13 -0300
Subject: [PATCH 05/15] chore(deps): pin follow-redirects to ^1.16.0
 (GHSA-r4q5-vmmm-2653)

Fixes Custom Authentication Header leak on cross-domain redirects.
Consumers include axios, http-proxy, and various test fixtures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 5e9c3346f221b..495306ac63af6 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,7 @@
 		"adm-zip": "0.5.9",
 		"cross-spawn": "7.0.6",
 		"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
+		"follow-redirects": "^1.16.0",
 		"lodash": "4.17.21",
 		"markdown-it": "^14.1.1",
 		"minimist": "1.2.6",
diff --git a/yarn.lock b/yarn.lock
index c2dddbed6997c..e1df340050627 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -22740,13 +22740,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.15.4, follow-redirects@npm:^1.15.6, follow-redirects@npm:^1.15.9":
-  version: 1.15.9
-  resolution: "follow-redirects@npm:1.15.9"
+"follow-redirects@npm:^1.16.0":
+  version: 1.16.0
+  resolution: "follow-redirects@npm:1.16.0"
   peerDependenciesMeta:
     debug:
       optional: true
-  checksum: 10/e3ab42d1097e90d28b913903841e6779eb969b62a64706a3eb983e894a5db000fbd89296f45f08885a0e54cd558ef62e81be1165da9be25a6c44920da10f424c
+  checksum: 10/3fbe3d80b3b544c22705d837aa5d4a0d07a740d913534a2620b0a004c610af4148e3b58723536dd099aaa1c9d3a155964bde9665d6e5cb331460809a1fc572fd
   languageName: node
   linkType: hard
 

From f470675c25b4385bbda67c06980de74f89f9d217 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:03:47 -0300
Subject: [PATCH 06/15] chore(deps): pin picomatch 2.x and 4.x ranges
 (GHSA-3v7f-55p6-f55p)

Fixes glob-matching method injection in POSIX character classes.
Range-scoped to keep 2.x consumers (anymatch, jest-util 29, readdirp,
micromatch) on ^2.3.2 and 4.x consumers (jest-util 30, vite,
tinyglobby) on ^4.0.4 rather than collapsing all to a single major.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json |  6 ++++++
 yarn.lock    | 23 ++++++++---------------
 2 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/package.json b/package.json
index 495306ac63af6..18e3702b41090 100644
--- a/package.json
+++ b/package.json
@@ -44,6 +44,12 @@
 		"markdown-it": "^14.1.1",
 		"minimist": "1.2.6",
 		"mongodb": "6.10.0",
+		"picomatch@npm:^2.0.4": "^2.3.2",
+		"picomatch@npm:^2.2.1": "^2.3.2",
+		"picomatch@npm:^2.2.3": "^2.3.2",
+		"picomatch@npm:^2.3.1": "^2.3.2",
+		"picomatch@npm:^4.0.2": "^4.0.4",
+		"picomatch@npm:^4.0.3": "^4.0.4",
 		"path-to-regexp@npm:^8.1.0": "^8.4.0",
 		"serialize-javascript": "^7.0.5",
 		"underscore": "1.13.8",
diff --git a/yarn.lock b/yarn.lock
index e1df340050627..84b260d4b89ff 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -30465,24 +30465,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.2.3, picomatch@npm:^2.3.1":
-  version: 2.3.1
-  resolution: "picomatch@npm:2.3.1"
-  checksum: 10/60c2595003b05e4535394d1da94850f5372c9427ca4413b71210f437f7b2ca091dbd611c45e8b37d10036fa8eade25c1b8951654f9d3973bfa66a2ff4d3b08bc
-  languageName: node
-  linkType: hard
-
-"picomatch@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "picomatch@npm:4.0.2"
-  checksum: 10/ce617b8da36797d09c0baacb96ca8a44460452c89362d7cb8f70ca46b4158ba8bc3606912de7c818eb4a939f7f9015cef3c766ec8a0c6bfc725fdc078e39c717
+"picomatch@npm:^2.3.2":
+  version: 2.3.2
+  resolution: "picomatch@npm:2.3.2"
+  checksum: 10/b788ef8148a2415b9dec12f0bb350ae6a5830f8f1950e472abc2f5225494debf7d1b75eb031df0ceaea9e8ec3e7bad599e8dbf3c60d61b42be429ba41bff4426
   languageName: node
   linkType: hard
 
-"picomatch@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "picomatch@npm:4.0.3"
-  checksum: 10/57b99055f40b16798f2802916d9c17e9744e620a0db136554af01d19598b96e45e2f00014c91d1b8b13874b80caa8c295b3d589a3f72373ec4aaf54baa5962d5
+"picomatch@npm:^4.0.4":
+  version: 4.0.4
+  resolution: "picomatch@npm:4.0.4"
+  checksum: 10/f6ef80a3590827ce20378ae110ac78209cc4f74d39236370f1780f957b7ee41c12acde0e4651b90f39983506fd2f5e449994716f516db2e9752924aff8de93ce
   languageName: node
   linkType: hard
 

From b868422fd6b8b798f1822e47f3031934ec1be6d9 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:25:28 -0300
Subject: [PATCH 07/15] chore(deps): pin brace-expansion 2.x and 5.x ranges
 (GHSA-f886-m6hf-6m8v)

Fixes zero-step sequence causing process hang and memory exhaustion.
Range-scoped to 2.x (^2.0.3) and 5.x (^5.0.5); the 1.1.11 line used by
minimatch 3.x/4.x is unaffected by the advisory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json |  2 ++
 yarn.lock    | 16 ++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/package.json b/package.json
index 18e3702b41090..69a26bbac0f0a 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,8 @@
 	"resolutions": {
 		"@sematext/gc-stats@npm:^1.5.9": "patch:@sematext/gc-stats@npm%3A1.5.9#~/.yarn/patches/@sematext-gc-stats-npm-1.5.9-01e77be4d0.patch",
 		"adm-zip": "0.5.9",
+		"brace-expansion@npm:^2.0.1": "^2.0.3",
+		"brace-expansion@npm:^5.0.2": "^5.0.5",
 		"cross-spawn": "7.0.6",
 		"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
 		"follow-redirects": "^1.16.0",
diff --git a/yarn.lock b/yarn.lock
index 84b260d4b89ff..c46154b081d18 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -17546,21 +17546,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "brace-expansion@npm:2.0.1"
+"brace-expansion@npm:^2.0.3":
+  version: 2.1.0
+  resolution: "brace-expansion@npm:2.1.0"
   dependencies:
     balanced-match: "npm:^1.0.0"
-  checksum: 10/a61e7cd2e8a8505e9f0036b3b6108ba5e926b4b55089eeb5550cd04a471fe216c96d4fe7e4c7f995c728c554ae20ddfc4244cad10aef255e72b62930afd233d1
+  checksum: 10/c77a7a64aabf94b8d5913955adb4f36957917565374461355bb4276830c027a313d981f32410cea9e38f52573e7eb776d02fe05091c3a79a061958d97e4d2b43
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^5.0.2":
-  version: 5.0.3
-  resolution: "brace-expansion@npm:5.0.3"
+"brace-expansion@npm:^5.0.5":
+  version: 5.0.5
+  resolution: "brace-expansion@npm:5.0.5"
   dependencies:
     balanced-match: "npm:^4.0.2"
-  checksum: 10/8ba7deae4ca333d52418d2cde3287ac23f44f7330d92c3ecd96a8941597bea8aab02227bd990944d6711dd549bcc6e550fe70be5d94aa02e2fdc88942f480c9b
+  checksum: 10/f259b2ddf04489da9512ad637ba6b4ef2d77abd4445d20f7f1714585f153435200a53fa6a2e4a5ee974df14ddad4cd16421f6f803e96e8b452bd48598878d0ee
   languageName: node
   linkType: hard
 

From 63fafa4750492734ff6f76b153e4226e34be3b5a Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:26:03 -0300
Subject: [PATCH 08/15] chore(deps): pin yaml 1.x and 2.x ranges
 (GHSA-48c2-rrv3-qjmp)

Fixes stack overflow via deeply nested YAML collections. Range-scoped
to cover cosmiconfig (^1.10.3), docker-compose, and typedoc (^2.8.3).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json |  3 +++
 yarn.lock    | 25 ++++++++-----------------
 2 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/package.json b/package.json
index 69a26bbac0f0a..3480edd1b27c7 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,9 @@
 		"serialize-javascript": "^7.0.5",
 		"underscore": "1.13.8",
 		"webpack": "~5.104.0",
+		"yaml@npm:^1.10.0": "^1.10.3",
+		"yaml@npm:^2.2.2": "^2.8.3",
+		"yaml@npm:^2.8.1": "^2.8.3",
 		"yauzl": "^3.2.1",
 		"yoga-layout@npm:^3.2.1": "patch:yoga-layout@npm%3A3.2.1#~/.yarn/patches/yoga-layout-npm-3.2.1-51ec934670.patch",
 		"@react-pdf/layout@npm:^4.4.2": "patch:@react-pdf/layout@npm%3A4.4.2#~/.yarn/patches/@react-pdf-layout-npm-4.4.2-6c2e3312fa.patch",
diff --git a/yarn.lock b/yarn.lock
index c46154b081d18..0ac66c9c1d1f5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -38291,28 +38291,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yaml@npm:^1.10.0":
-  version: 1.10.2
-  resolution: "yaml@npm:1.10.2"
-  checksum: 10/e088b37b4d4885b70b50c9fa1b7e54bd2e27f5c87205f9deaffd1fb293ab263d9c964feadb9817a7b129a5bf30a06582cb08750f810568ecc14f3cdbabb79cb3
+"yaml@npm:^1.10.3":
+  version: 1.10.3
+  resolution: "yaml@npm:1.10.3"
+  checksum: 10/e2ef2feb92c708138f016c69777a0f1e45f6d3c5e7cbcda30807a98a37eda2e008bd4fa57352b043c65245a4c799d0c99d1f9b3425de40e70929e26d2ea38215
   languageName: node
   linkType: hard
 
-"yaml@npm:^2.2.2":
-  version: 2.8.0
-  resolution: "yaml@npm:2.8.0"
-  bin:
-    yaml: bin.mjs
-  checksum: 10/7d4bd9c10d0e467601f496193f2ac254140f8e36f96f5ff7f852b9ce37974168eb7354f4c36dc8837dde527a2043d004b6aff48818ec24a69ab2dd3c6b6c381c
-  languageName: node
-  linkType: hard
-
-"yaml@npm:^2.8.1":
-  version: 2.8.1
-  resolution: "yaml@npm:2.8.1"
+"yaml@npm:^2.8.3":
+  version: 2.8.3
+  resolution: "yaml@npm:2.8.3"
   bin:
     yaml: bin.mjs
-  checksum: 10/eae07b3947d405012672ec17ce27348aea7d1fa0534143355d24a43a58f5e05652157ea2182c4fe0604f0540be71f99f1173f9d61018379404507790dff17665
+  checksum: 10/ecad41d39d34fae5cc17ea2d4b7f7f55faacd45cbce8983ba22d48d1ed1a92ed242ea49ea813a79ac39a69f75f9c5a03e7b5395fd954d55476f25e21a47c141d
   languageName: node
   linkType: hard
 

From 517fce4f256cf1b2577a20c4702b2026ea0460a9 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:27:02 -0300
Subject: [PATCH 09/15] chore(deps): pin undici 6.x to ^6.24.0

Fixes GHSA-4992-7rv2-5pvq (CRLF Injection via upgrade option),
GHSA-2mjp-6q6p-2qxm (HTTP Request/Response Smuggling),
GHSA-g9mf-h72j-4rw9 (unbounded decompression chain),
GHSA-cxrh-j4jr-qwg3 (DoS via bad certificate data).

Range-scoped so the 5.x line (used by @actions/* in the release tooling
only) is untouched.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 3480edd1b27c7..db0349c26a6f9 100644
--- a/package.json
+++ b/package.json
@@ -55,6 +55,7 @@
 		"path-to-regexp@npm:^8.1.0": "^8.4.0",
 		"serialize-javascript": "^7.0.5",
 		"underscore": "1.13.8",
+		"undici@npm:^6.19.5": "^6.24.0",
 		"webpack": "~5.104.0",
 		"yaml@npm:^1.10.0": "^1.10.3",
 		"yaml@npm:^2.2.2": "^2.8.3",
diff --git a/yarn.lock b/yarn.lock
index 0ac66c9c1d1f5..b129b72b0ed43 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -36807,10 +36807,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici@npm:^6.19.5":
-  version: 6.20.1
-  resolution: "undici@npm:6.20.1"
-  checksum: 10/68604b53754a95ec89d52efc08fe3e70e333997300c9a5b69f2b6496f1f0f568b2e35adec6442985a7b1d2f7a5648ef5062d1736e4d68082d473cb82177674bc
+"undici@npm:^6.24.0":
+  version: 6.25.0
+  resolution: "undici@npm:6.25.0"
+  checksum: 10/a475e45da3e1d1073283bb70531666f09a432eabff2b857bd7063d469a1ee1486192ff61dc0dadbb526673ce1120fee14d66a59b6b17d1e0bd3a4d5f0a52d0a6
   languageName: node
   linkType: hard
 

From c16ad7591c5e31592e128a98a311d6c0cb4bf055 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:27:31 -0300
Subject: [PATCH 10/15] chore(deps): pin handlebars to ^4.7.9

Fixes GHSA-442j-39wm-28r2 (container.lookup access bypass),
GHSA-7rx3-28cr-v5wh (missing __lookupSetter__ blocklist entry), and
GHSA-2qvq-rjwj-gvw9 (prototype pollution via partial template
injection). Only consumer is ts-jest (dev-only).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index db0349c26a6f9..d68a30772c4ea 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
 		"cross-spawn": "7.0.6",
 		"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
 		"follow-redirects": "^1.16.0",
+		"handlebars": "^4.7.9",
 		"lodash": "4.17.21",
 		"markdown-it": "^14.1.1",
 		"minimist": "1.2.6",
diff --git a/yarn.lock b/yarn.lock
index b129b72b0ed43..4b30f07876594 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -23546,9 +23546,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"handlebars@npm:^4.7.8":
-  version: 4.7.8
-  resolution: "handlebars@npm:4.7.8"
+"handlebars@npm:^4.7.9":
+  version: 4.7.9
+  resolution: "handlebars@npm:4.7.9"
   dependencies:
     minimist: "npm:^1.2.5"
     neo-async: "npm:^2.6.2"
@@ -23560,7 +23560,7 @@ __metadata:
       optional: true
   bin:
     handlebars: bin/handlebars
-  checksum: 10/bd528f4dd150adf67f3f857118ef0fa43ff79a153b1d943fa0a770f2599e38b25a7a0dbac1a3611a4ec86970fd2325a81310fb788b5c892308c9f8743bd02e11
+  checksum: 10/e755433d652e8a15fc02f83d7478e652359e7a4d354c4328818853ed4f8a39d4a09e1d22dad3c7213c5240864a65b3c840970b8b181745575dd957dd258f2b8d
   languageName: node
   linkType: hard
 

From 487cb3e944d03139abef74f97299125e19ddda46 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:28:23 -0300
Subject: [PATCH 11/15] chore(deps): pin fast-xml-parser 4.x and 5.x ranges

Fixes GHSA-8gc5-j5rx-235r (numeric entity expansion bypass, high),
GHSA-jp2q-39xq-3w4g (entity expansion limits bypass on zero),
GHSA-fj3w-jwp8-x2g3 (stack overflow in XMLBuilder with preserveOrder).

Range-scoped: is-svg and webdav on ^4.5.5; @aws-sdk/xml-builder's exact
5.3.6 pin is overridden to ^5.5.7. @google-cloud/storage's 5.5.11 was
already in the fixed range.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json |  3 +++
 yarn.lock    | 54 ++++++++++++++++++++++------------------------------
 2 files changed, 26 insertions(+), 31 deletions(-)

diff --git a/package.json b/package.json
index d68a30772c4ea..aebee8880f37e 100644
--- a/package.json
+++ b/package.json
@@ -41,6 +41,9 @@
 		"brace-expansion@npm:^5.0.2": "^5.0.5",
 		"cross-spawn": "7.0.6",
 		"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
+		"fast-xml-parser@npm:^4.2.4": "^4.5.5",
+		"fast-xml-parser@npm:^4.4.1": "^4.5.5",
+		"fast-xml-parser@npm:5.3.6": "^5.5.7",
 		"follow-redirects": "^1.16.0",
 		"handlebars": "^4.7.9",
 		"lodash": "4.17.21",
diff --git a/yarn.lock b/yarn.lock
index 4b30f07876594..989f23a31a50e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5680,6 +5680,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@nodable/entities@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@nodable/entities@npm:1.1.0"
+  checksum: 10/708e656b1e5d4e9e1b962c16cee4d05a3aed8f3e7e855214f81475f026abb3491fc6a7b4b37f0136ae31ddc7fce43ff4d69b14e1369f14ac1c51a0c2f010411d
+  languageName: node
+  linkType: hard
+
 "@node-oauth/formats@npm:1.0.0":
   version: 1.0.0
   resolution: "@node-oauth/formats@npm:1.0.0"
@@ -22326,29 +22333,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-xml-parser@npm:5.3.6":
-  version: 5.3.6
-  resolution: "fast-xml-parser@npm:5.3.6"
-  dependencies:
-    strnum: "npm:^2.1.2"
-  bin:
-    fxparser: src/cli/cli.js
-  checksum: 10/03527ab0bdf49d960fdc8f6088cd0715c052e06b68b39459da87b1a1fbb3439a855b2d83cbf3c400e983b8e668b396296b072a4dd5c63403cf1e618c9326b6df
-  languageName: node
-  linkType: hard
-
-"fast-xml-parser@npm:^4.2.4":
-  version: 4.5.1
-  resolution: "fast-xml-parser@npm:4.5.1"
-  dependencies:
-    strnum: "npm:^1.0.5"
-  bin:
-    fxparser: src/cli/cli.js
-  checksum: 10/17ce5908e798de1b6d12a39d26f04ac3b582ea9ce28f3a6e3b9c401edcb74790f28df84d75377608af53308ff8caad2b244ba1283cc4b5b4cf4cc7bd532a9983
-  languageName: node
-  linkType: hard
-
-"fast-xml-parser@npm:^4.4.1":
+"fast-xml-parser@npm:^4.5.5":
   version: 4.5.6
   resolution: "fast-xml-parser@npm:4.5.6"
   dependencies:
@@ -22372,6 +22357,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-xml-parser@npm:^5.5.7":
+  version: 5.6.0
+  resolution: "fast-xml-parser@npm:5.6.0"
+  dependencies:
+    "@nodable/entities": "npm:^1.1.0"
+    fast-xml-builder: "npm:^1.1.4"
+    path-expression-matcher: "npm:^1.5.0"
+    strnum: "npm:^2.2.3"
+  bin:
+    fxparser: src/cli/cli.js
+  checksum: 10/8ac171a569f997772b21a9cfdf0d94e3b376d211d914582afcf777a40919e8cb724e676f09e2959b2a5fe24c829fd59fc499ff7252d8c6722b8d8228d9015c0f
+  languageName: node
+  linkType: hard
+
 "fastest-levenshtein@npm:^1.0.12, fastest-levenshtein@npm:^1.0.16":
   version: 1.0.16
   resolution: "fastest-levenshtein@npm:1.0.16"
@@ -30254,7 +30253,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-expression-matcher@npm:^1.1.3, path-expression-matcher@npm:^1.4.0":
+"path-expression-matcher@npm:^1.1.3, path-expression-matcher@npm:^1.4.0, path-expression-matcher@npm:^1.5.0":
   version: 1.5.0
   resolution: "path-expression-matcher@npm:1.5.0"
   checksum: 10/28303bb9ee6831e6df14c10cd3f3f7b2d7c8d7f788d8bdb7440136fd696064c82a3e264999a0764d28e39f698275fc03a5493bec93c57ef4a22566280367dd64
@@ -35173,13 +35172,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strnum@npm:^2.1.2":
-  version: 2.2.0
-  resolution: "strnum@npm:2.2.0"
-  checksum: 10/2969dbc8441f5af1b55db1d2fcea64a8f912de18515b57f85574e66bdb8f30ae76c419cf1390b343d72d687e2aea5aca82390f18b9e0de45d6bcc6d605eb9385
-  languageName: node
-  linkType: hard
-
 "strnum@npm:^2.2.3":
   version: 2.2.3
   resolution: "strnum@npm:2.2.3"

From 48572125d9f6802e98da5df08988782a9d42803d Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:33:22 -0300
Subject: [PATCH 12/15] chore(deps): bump lodash resolution from 4.17.21 to
 ^4.18.0 (GHSA-f23m-r3pf-42rh)

Fixes prototype pollution via array path bypass in _.unset and _.omit.
Minor bump on a stable 4.x line; current 4.17.21 was a pinned LTS that
is now vulnerable.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index aebee8880f37e..60039605d8762 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
 		"fast-xml-parser@npm:5.3.6": "^5.5.7",
 		"follow-redirects": "^1.16.0",
 		"handlebars": "^4.7.9",
-		"lodash": "4.17.21",
+		"lodash": "^4.18.0",
 		"markdown-it": "^14.1.1",
 		"minimist": "1.2.6",
 		"mongodb": "6.10.0",
diff --git a/yarn.lock b/yarn.lock
index 989f23a31a50e..555f12fb4d5be 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -27541,10 +27541,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:4.17.21":
-  version: 4.17.21
-  resolution: "lodash@npm:4.17.21"
-  checksum: 10/c08619c038846ea6ac754abd6dd29d2568aa705feb69339e836dfa8d8b09abbb2f859371e86863eda41848221f9af43714491467b5b0299122431e202bb0c532
+"lodash@npm:^4.18.0":
+  version: 4.18.1
+  resolution: "lodash@npm:4.18.1"
+  checksum: 10/306fea53dfd39dad1f03d45ba654a2405aebd35797b673077f401edb7df2543623dc44b9effbb98f69b32152295fff725a4cec99c684098947430600c6af0c3f
   languageName: node
   linkType: hard
 

From ebcada57458229e17ee331522450b69f4a7e0ff9 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:41:58 -0300
Subject: [PATCH 13/15] =?UTF-8?q?chore(deps):=20bump=20nodemailer=207.0.13?=
 =?UTF-8?q?=20=E2=86=92=208.0.5=20in=20apps/meteor?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes GHSA-c7w3-x93f-qmm8 (SMTP command injection via envelope.size)
and GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport
name).

Only 8.0.0 breaking change is the 'NoAuth' → 'ENOAUTH' error code
rename, which is not referenced in the codebase. Also updated
@types/nodemailer to ^8.0.0 to match.

mailparser continues to pin nodemailer@7.0.9 internally; mailparser
does not exercise SMTP send paths, so the advisories do not apply.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 apps/meteor/package.json |  4 ++--
 yarn.lock                | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index ede2b121c42fa..de6ec4af925fe 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -255,7 +255,7 @@
 		"node-dogstatsd": "^0.0.7",
 		"node-fetch": "2.7.0",
 		"node-rsa": "^1.1.1",
-		"nodemailer": "^7.0.13",
+		"nodemailer": "^8.0.5",
 		"object-path": "^0.11.8",
 		"overlayscrollbars": "^2.11.4",
 		"overlayscrollbars-react": "^0.5.6",
@@ -378,7 +378,7 @@
 		"@types/mocha": "github:whitecolor/mocha-types",
 		"@types/node": "~22.16.5",
 		"@types/node-rsa": "^1.1.4",
-		"@types/nodemailer": "~6.4.22",
+		"@types/nodemailer": "^8.0.0",
 		"@types/oauth2-server": "^3.0.18",
 		"@types/object-path": "^0.11.4",
 		"@types/parseurl": "^1.3.3",
diff --git a/yarn.lock b/yarn.lock
index 555f12fb4d5be..ff377296fab70 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9943,7 +9943,7 @@ __metadata:
     "@types/mocha": "github:whitecolor/mocha-types"
     "@types/node": "npm:~22.16.5"
     "@types/node-rsa": "npm:^1.1.4"
-    "@types/nodemailer": "npm:~6.4.22"
+    "@types/nodemailer": "npm:^8.0.0"
     "@types/oauth2-server": "npm:^3.0.18"
     "@types/object-path": "npm:^0.11.4"
     "@types/parseurl": "npm:^1.3.3"
@@ -10078,7 +10078,7 @@ __metadata:
     node-dogstatsd: "npm:^0.0.7"
     node-fetch: "npm:2.7.0"
     node-rsa: "npm:^1.1.1"
-    nodemailer: "npm:^7.0.13"
+    nodemailer: "npm:^8.0.5"
     nyc: "npm:^17.1.0"
     object-path: "npm:^0.11.8"
     outdent: "npm:~0.8.0"
@@ -14670,12 +14670,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/nodemailer@npm:~6.4.22":
-  version: 6.4.22
-  resolution: "@types/nodemailer@npm:6.4.22"
+"@types/nodemailer@npm:^8.0.0":
+  version: 8.0.0
+  resolution: "@types/nodemailer@npm:8.0.0"
   dependencies:
     "@types/node": "npm:*"
-  checksum: 10/c4929dbdd3d0befc1943c50aea7778e9dd5deead81fa7400d513e2a66482864a4ea4467b78de14ab7f8ca91e68b6576cb9fcc66d467be9fd8a88ae64dca133c6
+  checksum: 10/d1178b557e8c547018e708459af06fdf2e9cfd6d65fed109517cddfe6b5add6201d941882a2e4eeede529de08ae71a68fb2a1d8f1c41cb3761d3a6c2458025fe
   languageName: node
   linkType: hard
 
@@ -29277,10 +29277,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nodemailer@npm:^7.0.13":
-  version: 7.0.13
-  resolution: "nodemailer@npm:7.0.13"
-  checksum: 10/4ae37bfb6896f1555de150c1098a7c1b28eb1da240a4c7adede81a8af0dcc184298cfbf804930599c076ea574428e0c18c6b28f0dc2072cebb30c1da5fd0b688
+"nodemailer@npm:^8.0.5":
+  version: 8.0.5
+  resolution: "nodemailer@npm:8.0.5"
+  checksum: 10/84d44afb0cd20ce02d5e4f0f8465b02aa0af0e11c1b0d40a4e9658d07321655a8ea528533840a38f213a45ca7865ec85f0aed6dc3ac3038d7b2c9405db6cd353
   languageName: node
   linkType: hard
 

From afb732df87b532b5c1bbb2769217e92cd4ec5796 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 19:50:00 -0300
Subject: [PATCH 14/15] =?UTF-8?q?chore(deps):=20bump=20file-type=2016.5.4?=
 =?UTF-8?q?=20=E2=86=92=2021.3.1=20in=20apps/meteor=20(GHSA-5v7r-6r5c-r473?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes infinite loop in ASF parser on malformed input with zero-size
sub-header.

file-type 17+ renamed the default-export callable API to named async
functions, and 19+ made the package ESM-only. Updated the two call
sites:

- `server/services/image/service.ts` now imports
  `fileTypeFromBuffer` and awaits it (was already in an async method).
- `ee/lib/misc/determineFileType.js` (used by the Apps engine upload
  bridge) is now async and awaits `fileTypeFromBuffer`. The sole caller
  `apps/server/bridges/uploads.ts` was already inside an async method.

No @types/file-type is needed; the package ships its own declarations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../meteor/app/apps/server/bridges/uploads.ts |  2 +-
 apps/meteor/ee/lib/misc/determineFileType.js  |  6 +-
 apps/meteor/package.json                      |  2 +-
 apps/meteor/server/services/image/service.ts  |  4 +-
 yarn.lock                                     | 75 +++++++++++--------
 5 files changed, 49 insertions(+), 40 deletions(-)

diff --git a/apps/meteor/app/apps/server/bridges/uploads.ts b/apps/meteor/app/apps/server/bridges/uploads.ts
index b9d0ff67de58e..d1a5d1c492ef0 100644
--- a/apps/meteor/app/apps/server/bridges/uploads.ts
+++ b/apps/meteor/app/apps/server/bridges/uploads.ts
@@ -51,7 +51,7 @@ export class AppUploadBridge extends UploadBridge {
 
 		const fileStore = FileUpload.getStore('Uploads');
 
-		details.type = determineFileType(buffer, details.name);
+		details.type = await determineFileType(buffer, details.name);
 
 		const uploadedFile = await fileStore.insert(getUploadDetails(details), buffer);
 		this.orch.debugLog(`The App ${appId} has created an upload`, uploadedFile);
diff --git a/apps/meteor/ee/lib/misc/determineFileType.js b/apps/meteor/ee/lib/misc/determineFileType.js
index 0942f78032ca2..d677e07e6b7b4 100644
--- a/apps/meteor/ee/lib/misc/determineFileType.js
+++ b/apps/meteor/ee/lib/misc/determineFileType.js
@@ -1,15 +1,15 @@
-import fileType from 'file-type';
+import { fileTypeFromBuffer } from 'file-type';
 
 import { mime as MIME } from '../../../app/utils/lib/mimeTypes';
 
-export function determineFileType(buffer, name) {
+export async function determineFileType(buffer, name) {
 	const mime = MIME.lookup(name);
 
 	if (mime) {
 		return Array.isArray(mime) ? mime[0] : mime;
 	}
 
-	const detectedType = fileType(buffer);
+	const detectedType = await fileTypeFromBuffer(buffer);
 
 	if (detectedType) {
 		return detectedType.mime;
diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index de6ec4af925fe..2ba1d85465639 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -206,7 +206,7 @@
 		"express-rate-limit": "^5.5.1",
 		"fastq": "^1.17.1",
 		"fflate": "^0.8.2",
-		"file-type": "^16.5.4",
+		"file-type": "^21.3.1",
 		"filenamify": "^4.3.0",
 		"filesize": "9.0.11",
 		"generate-password": "^1.7.1",
diff --git a/apps/meteor/server/services/image/service.ts b/apps/meteor/server/services/image/service.ts
index 85b4d2d05f979..f0e2071685605 100644
--- a/apps/meteor/server/services/image/service.ts
+++ b/apps/meteor/server/services/image/service.ts
@@ -5,7 +5,7 @@ import { ServiceClassInternal } from '@rocket.chat/core-services';
 import type { IMediaService, ResizeResult } from '@rocket.chat/core-services';
 import { streamToBuffer } from '@rocket.chat/tools';
 import ExifTransformer from 'exif-be-gone';
-import ft from 'file-type';
+import { fileTypeFromBuffer } from 'file-type';
 import isSvg from 'is-svg';
 import sharp from 'sharp';
 
@@ -80,7 +80,7 @@ export class MediaService extends ServiceClassInternal implements IMediaService
 	}
 
 	async isImage(buff: Buffer): Promise<boolean> {
-		const data = await ft.fromBuffer(buff);
+		const data = await fileTypeFromBuffer(buff);
 		if (!data?.ext) {
 			return false || this.isSvgImage(buff);
 		}
diff --git a/yarn.lock b/yarn.lock
index ff377296fab70..5ccc6c954bc2d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2855,6 +2855,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@borewit/text-codec@npm:^0.2.1":
+  version: 0.2.2
+  resolution: "@borewit/text-codec@npm:0.2.2"
+  checksum: 10/c971790a72d9e766286db71f68613d1bac3b8bd9eaba52fbf18a8b17903c095968ed5369efdba378751926440aab93f3dd17c89242ef20525808ddced22d49b8
+  languageName: node
+  linkType: hard
+
 "@bugsnag/browser@npm:^7.20.2":
   version: 7.20.2
   resolution: "@bugsnag/browser@npm:7.20.2"
@@ -10025,7 +10032,7 @@ __metadata:
     fast-glob: "npm:^3.3.3"
     fastq: "npm:^1.17.1"
     fflate: "npm:^0.8.2"
-    file-type: "npm:^16.5.4"
+    file-type: "npm:^21.3.1"
     filenamify: "npm:^4.3.0"
     filesize: "npm:9.0.11"
     generate-password: "npm:^1.7.1"
@@ -13418,6 +13425,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@tokenizer/inflate@npm:^0.4.1":
+  version: 0.4.1
+  resolution: "@tokenizer/inflate@npm:0.4.1"
+  dependencies:
+    debug: "npm:^4.4.3"
+    token-types: "npm:^6.1.1"
+  checksum: 10/27d58757e1a6c004e86f8a5f1a40fe47cb48aa6891864d03de6eab27d42fafc1456f396bc8bc300e16913b0a85f42034d011db0213d17e544ed201a7fc24244e
+  languageName: node
+  linkType: hard
+
 "@tokenizer/token@npm:^0.3.0":
   version: 0.3.0
   resolution: "@tokenizer/token@npm:0.3.0"
@@ -22470,14 +22487,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"file-type@npm:^16.5.4":
-  version: 16.5.4
-  resolution: "file-type@npm:16.5.4"
+"file-type@npm:^21.3.1":
+  version: 21.3.4
+  resolution: "file-type@npm:21.3.4"
   dependencies:
-    readable-web-to-node-stream: "npm:^3.0.0"
-    strtok3: "npm:^6.2.4"
-    token-types: "npm:^4.1.1"
-  checksum: 10/46ced46bb925ab547e0a6d43108a26d043619d234cb0588d7abce7b578dafac142bcfd2e23a6adb0a4faa4b951bd1b14b355134a193362e07cd352f9bf0dc349
+    "@tokenizer/inflate": "npm:^0.4.1"
+    strtok3: "npm:^10.3.4"
+    token-types: "npm:^6.1.1"
+    uint8array-extras: "npm:^1.4.0"
+  checksum: 10/42d5cf6aafb998fb2f0357e96ea7c48bcce5249f899523a3a5a4c297f4fe2346cc0aff9cf04243ada5c54b6457183550b2a04902b6533cd5e64aaa344d78e0eb
   languageName: node
   linkType: hard
 
@@ -30416,13 +30434,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"peek-readable@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "peek-readable@npm:4.1.0"
-  checksum: 10/97373215dcf382748645c3d22ac5e8dbd31759f7bd0c539d9fdbaaa7d22021838be3e55110ad0ed8f241c489342304b14a50dfee7ef3bcee2987d003b24ecc41
-  languageName: node
-  linkType: hard
-
 "peggy@npm:4.1.1":
   version: 4.1.1
   resolution: "peggy@npm:4.1.1"
@@ -32715,15 +32726,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"readable-web-to-node-stream@npm:^3.0.0":
-  version: 3.0.2
-  resolution: "readable-web-to-node-stream@npm:3.0.2"
-  dependencies:
-    readable-stream: "npm:^3.6.0"
-  checksum: 10/d3a5bf9d707c01183d546a64864aa63df4d9cb835dfd2bf89ac8305e17389feef2170c4c14415a10d38f9b9bfddf829a57aaef7c53c8b40f11d499844bf8f1a4
-  languageName: node
-  linkType: hard
-
 "readdir-glob@npm:^1.1.2":
   version: 1.1.3
   resolution: "readdir-glob@npm:1.1.3"
@@ -35179,13 +35181,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strtok3@npm:^6.2.4":
-  version: 6.3.0
-  resolution: "strtok3@npm:6.3.0"
+"strtok3@npm:^10.3.4":
+  version: 10.3.5
+  resolution: "strtok3@npm:10.3.5"
   dependencies:
     "@tokenizer/token": "npm:^0.3.0"
-    peek-readable: "npm:^4.1.0"
-  checksum: 10/98fba564d3830202aa3a6bcd5ccaf2cbd849bd87ae79ece91d337e1913916705a8e633c9577138d030a984f8ec987dea51807e01252f995cf5e183fdea35eb2b
+  checksum: 10/7279dc97a7207a5664ea07cf5304b94968db4f02d64d2732be8e7a3a31a876375126749cd36a00d0bd54c891875f3e47175f8194d40c64118f3265dbc241aaca
   languageName: node
   linkType: hard
 
@@ -36035,13 +36036,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"token-types@npm:^4.1.1":
-  version: 4.2.0
-  resolution: "token-types@npm:4.2.0"
+"token-types@npm:^6.1.1":
+  version: 6.1.2
+  resolution: "token-types@npm:6.1.2"
   dependencies:
+    "@borewit/text-codec": "npm:^0.2.1"
     "@tokenizer/token": "npm:^0.3.0"
     ieee754: "npm:^1.2.1"
-  checksum: 10/7ca20361b9266c9b101cdd0a7c14ead851f13b6622fbf2f6fa79aa7148a83a64b833bcfa0d23b32895605570f70a25eecd6eebfa82abe0d1a84d7a509184d619
+  checksum: 10/0c7811a2da5a0ca474c795d883d871a184d1d54f67058d66084110f0b246fff66151885dbcb91d66533e776478bf57f3b4fac69ce03b805a0e1060def87947de
   languageName: node
   linkType: hard
 
@@ -36764,6 +36766,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uint8array-extras@npm:^1.4.0":
+  version: 1.5.0
+  resolution: "uint8array-extras@npm:1.5.0"
+  checksum: 10/94fd56a2dda6a7445f5176f301f491814c87757d38e4b3c932299ab54d69ec504830e5d5c18ffa20cf694a69a210315be8b4a2c9952c6334da817ea2d2e1dce0
+  languageName: node
+  linkType: hard
+
 "unbox-primitive@npm:^1.1.0":
   version: 1.1.0
   resolution: "unbox-primitive@npm:1.1.0"

From b0d822562dea38528cd13913358f162252de4a35 Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Wed, 15 Apr 2026 20:24:25 -0300
Subject: [PATCH 15/15] =?UTF-8?q?Revert=20"chore(deps):=20bump=20file-type?=
 =?UTF-8?q?=2016.5.4=20=E2=86=92=2021.3.1=20in=20apps/meteor=20(GHSA-5v7r-?=
 =?UTF-8?q?6r5c-r473)"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit afb732df87b532b5c1bbb2769217e92cd4ec5796.
---
 .../meteor/app/apps/server/bridges/uploads.ts |  2 +-
 apps/meteor/ee/lib/misc/determineFileType.js  |  6 +-
 apps/meteor/package.json                      |  2 +-
 apps/meteor/server/services/image/service.ts  |  4 +-
 yarn.lock                                     | 75 ++++++++-----------
 5 files changed, 40 insertions(+), 49 deletions(-)

diff --git a/apps/meteor/app/apps/server/bridges/uploads.ts b/apps/meteor/app/apps/server/bridges/uploads.ts
index d1a5d1c492ef0..b9d0ff67de58e 100644
--- a/apps/meteor/app/apps/server/bridges/uploads.ts
+++ b/apps/meteor/app/apps/server/bridges/uploads.ts
@@ -51,7 +51,7 @@ export class AppUploadBridge extends UploadBridge {
 
 		const fileStore = FileUpload.getStore('Uploads');
 
-		details.type = await determineFileType(buffer, details.name);
+		details.type = determineFileType(buffer, details.name);
 
 		const uploadedFile = await fileStore.insert(getUploadDetails(details), buffer);
 		this.orch.debugLog(`The App ${appId} has created an upload`, uploadedFile);
diff --git a/apps/meteor/ee/lib/misc/determineFileType.js b/apps/meteor/ee/lib/misc/determineFileType.js
index d677e07e6b7b4..0942f78032ca2 100644
--- a/apps/meteor/ee/lib/misc/determineFileType.js
+++ b/apps/meteor/ee/lib/misc/determineFileType.js
@@ -1,15 +1,15 @@
-import { fileTypeFromBuffer } from 'file-type';
+import fileType from 'file-type';
 
 import { mime as MIME } from '../../../app/utils/lib/mimeTypes';
 
-export async function determineFileType(buffer, name) {
+export function determineFileType(buffer, name) {
 	const mime = MIME.lookup(name);
 
 	if (mime) {
 		return Array.isArray(mime) ? mime[0] : mime;
 	}
 
-	const detectedType = await fileTypeFromBuffer(buffer);
+	const detectedType = fileType(buffer);
 
 	if (detectedType) {
 		return detectedType.mime;
diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 2ba1d85465639..de6ec4af925fe 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -206,7 +206,7 @@
 		"express-rate-limit": "^5.5.1",
 		"fastq": "^1.17.1",
 		"fflate": "^0.8.2",
-		"file-type": "^21.3.1",
+		"file-type": "^16.5.4",
 		"filenamify": "^4.3.0",
 		"filesize": "9.0.11",
 		"generate-password": "^1.7.1",
diff --git a/apps/meteor/server/services/image/service.ts b/apps/meteor/server/services/image/service.ts
index f0e2071685605..85b4d2d05f979 100644
--- a/apps/meteor/server/services/image/service.ts
+++ b/apps/meteor/server/services/image/service.ts
@@ -5,7 +5,7 @@ import { ServiceClassInternal } from '@rocket.chat/core-services';
 import type { IMediaService, ResizeResult } from '@rocket.chat/core-services';
 import { streamToBuffer } from '@rocket.chat/tools';
 import ExifTransformer from 'exif-be-gone';
-import { fileTypeFromBuffer } from 'file-type';
+import ft from 'file-type';
 import isSvg from 'is-svg';
 import sharp from 'sharp';
 
@@ -80,7 +80,7 @@ export class MediaService extends ServiceClassInternal implements IMediaService
 	}
 
 	async isImage(buff: Buffer): Promise<boolean> {
-		const data = await fileTypeFromBuffer(buff);
+		const data = await ft.fromBuffer(buff);
 		if (!data?.ext) {
 			return false || this.isSvgImage(buff);
 		}
diff --git a/yarn.lock b/yarn.lock
index 5ccc6c954bc2d..ff377296fab70 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2855,13 +2855,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@borewit/text-codec@npm:^0.2.1":
-  version: 0.2.2
-  resolution: "@borewit/text-codec@npm:0.2.2"
-  checksum: 10/c971790a72d9e766286db71f68613d1bac3b8bd9eaba52fbf18a8b17903c095968ed5369efdba378751926440aab93f3dd17c89242ef20525808ddced22d49b8
-  languageName: node
-  linkType: hard
-
 "@bugsnag/browser@npm:^7.20.2":
   version: 7.20.2
   resolution: "@bugsnag/browser@npm:7.20.2"
@@ -10032,7 +10025,7 @@ __metadata:
     fast-glob: "npm:^3.3.3"
     fastq: "npm:^1.17.1"
     fflate: "npm:^0.8.2"
-    file-type: "npm:^21.3.1"
+    file-type: "npm:^16.5.4"
     filenamify: "npm:^4.3.0"
     filesize: "npm:9.0.11"
     generate-password: "npm:^1.7.1"
@@ -13425,16 +13418,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@tokenizer/inflate@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "@tokenizer/inflate@npm:0.4.1"
-  dependencies:
-    debug: "npm:^4.4.3"
-    token-types: "npm:^6.1.1"
-  checksum: 10/27d58757e1a6c004e86f8a5f1a40fe47cb48aa6891864d03de6eab27d42fafc1456f396bc8bc300e16913b0a85f42034d011db0213d17e544ed201a7fc24244e
-  languageName: node
-  linkType: hard
-
 "@tokenizer/token@npm:^0.3.0":
   version: 0.3.0
   resolution: "@tokenizer/token@npm:0.3.0"
@@ -22487,15 +22470,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"file-type@npm:^21.3.1":
-  version: 21.3.4
-  resolution: "file-type@npm:21.3.4"
+"file-type@npm:^16.5.4":
+  version: 16.5.4
+  resolution: "file-type@npm:16.5.4"
   dependencies:
-    "@tokenizer/inflate": "npm:^0.4.1"
-    strtok3: "npm:^10.3.4"
-    token-types: "npm:^6.1.1"
-    uint8array-extras: "npm:^1.4.0"
-  checksum: 10/42d5cf6aafb998fb2f0357e96ea7c48bcce5249f899523a3a5a4c297f4fe2346cc0aff9cf04243ada5c54b6457183550b2a04902b6533cd5e64aaa344d78e0eb
+    readable-web-to-node-stream: "npm:^3.0.0"
+    strtok3: "npm:^6.2.4"
+    token-types: "npm:^4.1.1"
+  checksum: 10/46ced46bb925ab547e0a6d43108a26d043619d234cb0588d7abce7b578dafac142bcfd2e23a6adb0a4faa4b951bd1b14b355134a193362e07cd352f9bf0dc349
   languageName: node
   linkType: hard
 
@@ -30434,6 +30416,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"peek-readable@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "peek-readable@npm:4.1.0"
+  checksum: 10/97373215dcf382748645c3d22ac5e8dbd31759f7bd0c539d9fdbaaa7d22021838be3e55110ad0ed8f241c489342304b14a50dfee7ef3bcee2987d003b24ecc41
+  languageName: node
+  linkType: hard
+
 "peggy@npm:4.1.1":
   version: 4.1.1
   resolution: "peggy@npm:4.1.1"
@@ -32726,6 +32715,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"readable-web-to-node-stream@npm:^3.0.0":
+  version: 3.0.2
+  resolution: "readable-web-to-node-stream@npm:3.0.2"
+  dependencies:
+    readable-stream: "npm:^3.6.0"
+  checksum: 10/d3a5bf9d707c01183d546a64864aa63df4d9cb835dfd2bf89ac8305e17389feef2170c4c14415a10d38f9b9bfddf829a57aaef7c53c8b40f11d499844bf8f1a4
+  languageName: node
+  linkType: hard
+
 "readdir-glob@npm:^1.1.2":
   version: 1.1.3
   resolution: "readdir-glob@npm:1.1.3"
@@ -35181,12 +35179,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strtok3@npm:^10.3.4":
-  version: 10.3.5
-  resolution: "strtok3@npm:10.3.5"
+"strtok3@npm:^6.2.4":
+  version: 6.3.0
+  resolution: "strtok3@npm:6.3.0"
   dependencies:
     "@tokenizer/token": "npm:^0.3.0"
-  checksum: 10/7279dc97a7207a5664ea07cf5304b94968db4f02d64d2732be8e7a3a31a876375126749cd36a00d0bd54c891875f3e47175f8194d40c64118f3265dbc241aaca
+    peek-readable: "npm:^4.1.0"
+  checksum: 10/98fba564d3830202aa3a6bcd5ccaf2cbd849bd87ae79ece91d337e1913916705a8e633c9577138d030a984f8ec987dea51807e01252f995cf5e183fdea35eb2b
   languageName: node
   linkType: hard
 
@@ -36036,14 +36035,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"token-types@npm:^6.1.1":
-  version: 6.1.2
-  resolution: "token-types@npm:6.1.2"
+"token-types@npm:^4.1.1":
+  version: 4.2.0
+  resolution: "token-types@npm:4.2.0"
   dependencies:
-    "@borewit/text-codec": "npm:^0.2.1"
     "@tokenizer/token": "npm:^0.3.0"
     ieee754: "npm:^1.2.1"
-  checksum: 10/0c7811a2da5a0ca474c795d883d871a184d1d54f67058d66084110f0b246fff66151885dbcb91d66533e776478bf57f3b4fac69ce03b805a0e1060def87947de
+  checksum: 10/7ca20361b9266c9b101cdd0a7c14ead851f13b6622fbf2f6fa79aa7148a83a64b833bcfa0d23b32895605570f70a25eecd6eebfa82abe0d1a84d7a509184d619
   languageName: node
   linkType: hard
 
@@ -36766,13 +36764,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uint8array-extras@npm:^1.4.0":
-  version: 1.5.0
-  resolution: "uint8array-extras@npm:1.5.0"
-  checksum: 10/94fd56a2dda6a7445f5176f301f491814c87757d38e4b3c932299ab54d69ec504830e5d5c18ffa20cf694a69a210315be8b4a2c9952c6334da817ea2d2e1dce0
-  languageName: node
-  linkType: hard
-
 "unbox-primitive@npm:^1.1.0":
   version: 1.1.0
   resolution: "unbox-primitive@npm:1.1.0"